web_expression_4_setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
web_expression_4_setup.exe
Size 4.9MB
Sample261002-eqcskatt4n
SHA256 3002e85fdf700ba82674bc61296c35bd5afd694d9ad0c6d2709835eeeb78db1a
MD5 edf1e4a058af6203084eeb5eeb0455aa
SHA1 a57d2298adff362483607c10ee77450cc0a9311a
SHA512 3ee31af062326a6f6dc408ee3868a9c06ce37ce75d1dba534e8aa7f8c743816fed485f4df4ffd822d849a779a3f709714148009f8874fbfea7f29856eb37b989
SSDEEP 98304:YfprmihQNhcvIInWpUnKMbGrkqKt2uwTHTE0TNv5ylYcp+6B:YfpbhQNhFLUKMSrRKtdMHNxhkno6B
TLSH
T17F363389334B1DDAD9E22E32CF4B1146CC98FA50DB81DB9F81B55F14D8AD9404BDBA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
web_expression_4_setup.exe

File Explorer

web_expression_4_setup.exe

.exe 4.9MB

web_expression_4_setup.exe

IMPHASH 092eb6daba2f17cbda102fd1a32acd00
SHA256 3002e85fdf700ba82674bc61296c35bd5afd694d9ad0c6d2709835eeeb78db1a
MD5 edf1e4a058af6203084eeb5eeb0455aa
SHA1 a57d2298adff362483607c10ee77450cc0a9311a
SHA512 3ee31af062326a6f6dc408ee3868a9c06ce37ce75d1dba534e8aa7f8c743816fed485f4df4ffd822d849a779a3f709714148009f8874fbfea7f29856eb37b989
SSDEEP 98304:YfprmihQNhcvIInWpUnKMbGrkqKt2uwTHTE0TNv5ylYcp+6B:YfpbhQNhFLUKMSrRKtdMHNxhkno6B
TLSH
T17F363389334B1DDAD9E22E32CF4B1146CC98FA50DB81DB9F81B55F14D8AD9404BDBA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

kernel32

GetDriveTypeA HeapFree FormatMessageA LeaveCriticalSection DeleteFileA EnterCriticalSection TerminateProcess WaitForMultipleObjects CreateEventW SetEvent Sleep SetEnvironmentVariableA GetEnvironmentVariableA WideCharToMultiByte HeapAlloc SetLastError WriteFile MoveFileA ExitProcess DeleteCriticalSection FlushFileBuffers GetVersionExA WaitForSingleObject OpenEventA GetCurrentProcess GetFileAttributesA GetCommandLineA GetModuleFileNameA CreateFileA FindNextFileA FindFirstFileA CopyFileA SetFileAttributesA SystemTimeToFileTime GetSystemTime GetDiskFreeSpaceA QueryDosDeviceA GetCurrentDirectoryA SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetExitCodeProcess CreateProcessA ExpandEnvironmentStringsA GetFileSize CreateThread CreateEventA GetProcessHeap InitializeCriticalSectionAndSpinCount GetModuleHandleA QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime SetUnhandledExceptionFilter CloseHandle DeviceIoControl GetSystemDirectoryA LoadLibraryA GetProcAddress FreeLibrary SetErrorMode GetTickCount CreateDirectoryA GetLastError RemoveDirectoryA MoveFileExA SetFilePointer FindClose ReadFile

msvcrt

strchr _strnicmp _stricmp strrchr _strlwr strncpy strstr _snprintf sprintf

advapi32

AllocateAndInitializeSid GetTokenInformation GetLengthSid InitiateSystemShutdownA CryptReleaseContext CryptGenRandom CryptAcquireContextA SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl InitializeSecurityDescriptor OpenProcessToken

user32

ShowWindow SendDlgItemMessageA SendMessageA DialogBoxParamA LoadStringA EndDialog SetParent MessageBoxA

ntdll

NtShutdownSystem NtAdjustPrivilegesToken NtClose NtOpenProcessToken

comctl32

ord17

shell32

SHBrowseForFolderA SHGetPathFromIDListA